CVE-2026-74343

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

kernfs: fix xattr race condition with multiple superblocks

Multiple superblocks with different namespaces can share the same

kernfs_node when kernfs_test_super() finds a matching root but

different namespace. This means multiple inodes from different

superblocks can reference the same kernfs_node->iattr->xattrs

structure.

The VFS layer only holds per-inode locks during xattr operations,

which is insufficient to serialize concurrent xattr modifications on

the shared kernfs_node. This can lead to race conditions in

simple_xattr_set() where the lookup->replace/remove sequence is not

atomic with respect to operations from other superblocks.

Fix this by protecting xattr operations with the existing hashed

kernfs_locks->open_file_mutex[] array, which is already used to

protect per-node open file data. The hashed mutex array provides

scalable per-node serialization (scaled by CPU count, up to 1024 locks

on 32+ CPU systems

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References